fix cookie strategy to work with for all subdomains